From owner-freebsd-questions@FreeBSD.ORG  Fri Jun  6 11:58:49 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6BECE37B401
	for <questions@freebsd.org>; Fri,  6 Jun 2003 11:58:49 -0700 (PDT)
Received: from adsl-64-161-78-226.dsl.lsan03.pacbell.net
	(adsl-64-161-78-226.dsl.lsan03.pacbell.net [64.161.78.226])
	by mx1.FreeBSD.org (Postfix) with SMTP id 6BD5F43FD7
	for <questions@freebsd.org>; Fri,  6 Jun 2003 11:58:48 -0700 (PDT)
	(envelope-from oremanj@adsl-64-161-78-226.dsl.lsan03.pacbell.net)
Received: (qmail 45382 invoked by uid 1001); 6 Jun 2003 19:00:26 -0000
Date: Fri, 6 Jun 2003 12:00:26 -0700
From: Joshua Oreman <oremanj@webserver.get-linux.org>
To: xcas@cox.net
Message-ID: <20030606190026.GA45315@webserver.get-linux.org>
References: <20030606110904.T38001@localhost.bsd-unix.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20030606110904.T38001@localhost.bsd-unix.org>
User-Agent: Mutt/1.4.1i
cc: questions@freebsd.org
Subject: Re: chkrootkit-0.40 & FreeBSD 5.1
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Jun 2003 18:58:49 -0000

On Fri, Jun 06, 2003 at 11:21:47AM -0700 or thereabouts, xcas@cox.net seemed to write:
> Is there a problem with 'chkrootkit-0.40' on 5.x? It tells me that some of
> the files are infected (I know for a fact that they're not)..
> 
> Files reported as infected:
> /usr/bin/chfn
> /usr/bin/chsh
> /bin/date
> /bin/ls
> /bin/ps
> 
> localhost# uname -a
> FreeBSD localhost.tuxsux.org 5.1-RELEASE FreeBSD 5.1-RELEASE #0: Wed Jun  4 06:09:58 MST 2003
> cas@localhost.tuxsux.org:/usr/obj/usr/src/sys/KADAFI  i386

Yes.
It gives false positives for these 5 commands.

-- Josh

> _______________________________________________
> freebsd-questions@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"